Linux kernel (drivers/vfio): Pinned-memory accounting for a VFIO container is lost across exec(), then underflows to a

CVSS 6.5CVE-2023-53171Kernel, userspace & hypervisorcurated

Impact

Pinned-memory accounting for a VFIO container is lost across exec(), then underflows to a huge unsigned value on unmap. A tenant that maps DMA, execs, and repeats sheds its RLIMIT_MEMLOCK charge each round and can pin host RAM without bound until the node runs out of memory - a noisy-neighbour outage for everyone on the box. The underflow also permanently wedges further DMA maps for that container.

Who can reach it

Any container holding /dev/vfio/vfio and a group fd, using the legacy type1 container. The sequence is map DMA, exec() (the container fd survives), repeat. No host root, no special hardware, no race window to win.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: put a hard memory cgroup limit on tenants holding VFIO containers rather than relying on RLIMIT_MEMLOCK alone, and drop /dev/vfio from containers that do not need passthrough.

References

https://git.kernel.org/stable/c/5a271242716846cc016736fb76be2b40ee49b0c3 https://git.kernel.org/stable/c/eafb81c50da899dd80b340c841277acc4a1945b7 https://nvd.nist.gov/vuln/detail/CVE-2023-53171

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.